| Date | 2026-10-29 |
| Severity | reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: critical (container bluespice/wiki in BlueSpice pro and farm, publicly readable wikis), high (same, wikis that require a login), medium (container bluespice/chat), low (all other containers) CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: medium (containers |
| Affected |
|
| Fixed in |
|
| CVE |
Problem
CVE-2026-111497: A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the curl library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.
CVE-2026-115557: The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.
| CVE | Component | Type of vulnerability | BlueSpice 5 |
|---|---|---|---|
| CVE-2026-111497 | Brotli library (container bluespice/wiki in BlueSpice pro and farm)
|
Out-of-bounds write when decompressing data, remote code execution | affected |
| CVE-2026-111497 | Node.js (container bluespice/chat)
|
Out-of-bounds write when decompressing data, possibly remote code execution | affected, if MS Teams integration is used |
| CVE-2026-111497 | Brotli library / Node.js (other containers) | Out-of-bounds write when decompressing data | not exploitable |
| CVE-2026-115557 | Python (container bluespice/ai)
|
Forged server certificates are accepted for outgoing connections | affected, if the AI service is used |
| CVE-2026-115557 (same issue in Node.js) | Node.js (container bluespice/chat)
|
Forged server certificates are accepted for outgoing connections | affected, if the chat service is used |
| CVE-2026-115557 | Python / Node.js / Java (other containers) | Forged server certificates are accepted for outgoing connections | not affected |
Impact assessment
| Component | Assessment | Mitigation without update |
|---|---|---|
Container bluespice/wiki (BlueSpice pro and farm)
|
Critical on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.
Unlike the PHP vulnerabilities in BSSA-2026-08, network access to the wiki is not enough. The attacker needs read access to the wiki itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet. |
Disable the extensions ExternalData and ExternalContent (see below). |
Container bluespice/chat
|
Medium. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of bluespice-deploy. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.
|
Do not expose the MS Teams connector, or reject requests with the header Content-Encoding: br in the reverse proxy in front of it.
|
All other containers, including bluespice/wiki in BlueSpice free
|
Low. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration. | None required. Update with the next maintenance. |
Container bluespice/ai (CVE-2026-115557)
|
Medium. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks. | Disable the AI service until BlueSpice 5.2.8: set AI=false in the .env file and run ./bluespice-deploy up -d --remove-orphans. The AI features of the wiki and the chat are not available until then.
|
Container bluespice/chat (CVE-2026-115557, same issue in Node.js)
|
Medium. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector. | None. Update to BlueSpice 5.2.7.2, or disable the chat service. |
| All other containers (CVE-2026-115557) | Not affected. bluespice/wiki and bluespice/search contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.
|
None required. |
Solution
Update to BlueSpice 5.2.7.2 or BlueSpice 5.1.11.2. As with BSSA-2026-08, these are nano releases without functional changes. We recommend the update for bluespice/wiki in all editions (free, pro and farm). All containers except bluespice/ai were rebuilt with the fixed Brotli library (brotli-libs 1.2.1) and fixed Node.js versions. The image tags 5, 5.2 and 5.1 point to the fixed images.
In the .env file of bluespice-deploy, set VERSION to 5.2 or 5.1. Then run these commands in the compose directory of bluespice-deploy: ./bluespice-deploy pull && ./bluespice-deploy up -d. Use the bluespice-deploy script instead of plain docker compose, because only the script loads all required docker-compose.*.yml files.
To check whether your installation is fixed, run:
./bluespice-deploy exec wiki-web apk info -v brotli-libsand./bluespice-deploy exec wiki-task apk info -v brotli-libs: must showbrotli-libs-1.2.1-r0or higher./bluespice-deploy exec chat node -v(BlueSpice 5.2, only if the chat service is used): must showv24.22.1or higher
The container bluespice/ai was not rebuilt for BlueSpice 5.2.7.2. It will be fixed in BlueSpice 5.2.8. Until then, disable the AI service as described in the table above, if you use it.
Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm)
Use the same method as in BSSA-2026-06: mount a copy of the settings file in which the extensions are not loaded. In BlueSpice 5.1, the command only finds ExternalData, as ExternalContent is not part of 5.1.
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i -E "s/^(wfLoadExtension\( 'External(Data|Content)' \);)/#\1/" 040-BlueSpiceProDistribution.php
Add the file to docker-compose.override.yml:
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
Then re-create the containers with ./bluespice-deploy up -d. The copied file belongs to the current version. Remove the mount before or together with the update.
While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.
Was my installation compromised?
We do not know of any attacks on BlueSpice installations. The vulnerability has been public since 2026-10-21. Public exploit code for a comparable PHP application exists since 2026-10-28.
Installing the update or disabling the extensions stops further exploitation. It does not remove anything an attacker may have left behind. If your wiki uses BlueSpice pro or farm and could connect to servers on the internet, check:
- Pages, templates and modules with
{{#get_web_data}},{{#get_external_data}}or{{#embed}}that point to servers you do not know, and modules that usemw.ext.externalData. - The access log of the reverse proxy for requests to
api.phporindex.phpwith these functions. They can also be used without saving a page, e.g. in a preview. See the notes on log analysis in BSSA-2026-06. - The logs of
wiki-webandwiki-taskfor processes that ended with a segmentation fault (e.g.exited on signal 11), and, if available, your firewall logs for connections from the wiki to unknown servers.
If you find signs of an attack, follow the procedure in BSSA-2026-08 (section "Was my installation compromised?") and contact the Hallo Welt! GmbH support.
BlueSpice cloud
BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.
